blob: 32ac8a234c7a7b0efbc602d6ce6ca5cd591e77fa [file] [log] [blame]
Darin Petkov1c115202012-03-22 15:35:47 +01001// Copyright (c) 2012 The Chromium OS Authors. All rights reserved.
2// Use of this source code is governed by a BSD-style license that can be
3// found in the LICENSE file.
4
5#include "shill/openvpn_management_server.h"
6
Darin Petkov46463022012-03-29 14:57:32 +02007#include <arpa/inet.h>
Darin Petkov78f63262012-03-26 01:30:24 +02008#include <netinet/in.h>
9
10#include <base/bind.h>
Darin Petkov46463022012-03-29 14:57:32 +020011#include <base/string_number_conversions.h>
Darin Petkov78f63262012-03-26 01:30:24 +020012#include <base/string_split.h>
13#include <base/string_util.h>
14#include <base/stringprintf.h>
Darin Petkov683942b2012-03-27 18:00:04 +020015#include <chromeos/dbus/service_constants.h>
Darin Petkov78f63262012-03-26 01:30:24 +020016
17#include "shill/event_dispatcher.h"
Darin Petkov683942b2012-03-27 18:00:04 +020018#include "shill/glib.h"
Christopher Wileyb691efd2012-08-09 13:51:51 -070019#include "shill/logging.h"
Darin Petkov271fe522012-03-27 13:47:29 +020020#include "shill/openvpn_driver.h"
Darin Petkov78f63262012-03-26 01:30:24 +020021#include "shill/sockets.h"
22
23using base::Bind;
Darin Petkov46463022012-03-29 14:57:32 +020024using base::IntToString;
Darin Petkov78f63262012-03-26 01:30:24 +020025using base::SplitString;
26using base::StringPrintf;
27using std::string;
28using std::vector;
Darin Petkov1c115202012-03-22 15:35:47 +010029
30namespace shill {
31
Darin Petkov683942b2012-03-27 18:00:04 +020032OpenVPNManagementServer::OpenVPNManagementServer(OpenVPNDriver *driver,
33 GLib *glib)
Darin Petkov78f63262012-03-26 01:30:24 +020034 : driver_(driver),
Darin Petkov683942b2012-03-27 18:00:04 +020035 glib_(glib),
Darin Petkov78f63262012-03-26 01:30:24 +020036 weak_ptr_factory_(this),
37 ready_callback_(Bind(&OpenVPNManagementServer::OnReady,
38 weak_ptr_factory_.GetWeakPtr())),
39 input_callback_(Bind(&OpenVPNManagementServer::OnInput,
40 weak_ptr_factory_.GetWeakPtr())),
41 sockets_(NULL),
42 socket_(-1),
43 dispatcher_(NULL),
Darin Petkova5e07ef2012-07-09 14:27:57 +020044 connected_socket_(-1),
45 hold_waiting_(false),
46 hold_release_(false) {}
Darin Petkov1c115202012-03-22 15:35:47 +010047
Darin Petkov78f63262012-03-26 01:30:24 +020048OpenVPNManagementServer::~OpenVPNManagementServer() {
Darin Petkov46463022012-03-29 14:57:32 +020049 OpenVPNManagementServer::Stop();
Darin Petkov78f63262012-03-26 01:30:24 +020050}
Darin Petkov1c115202012-03-22 15:35:47 +010051
Darin Petkov78f63262012-03-26 01:30:24 +020052bool OpenVPNManagementServer::Start(EventDispatcher *dispatcher,
Darin Petkov46463022012-03-29 14:57:32 +020053 Sockets *sockets,
54 vector<string> *options) {
Ben Chanfad4a0b2012-04-18 15:49:59 -070055 SLOG(VPN, 2) << __func__;
Darin Petkove08084d2012-06-11 13:19:35 +020056 if (IsStarted()) {
Darin Petkov78f63262012-03-26 01:30:24 +020057 return true;
58 }
59
Darin Petkov271fe522012-03-27 13:47:29 +020060 int socket = sockets->Socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
Darin Petkov78f63262012-03-26 01:30:24 +020061 if (socket < 0) {
62 PLOG(ERROR) << "Unable to create management server socket.";
63 return false;
64 }
65
66 struct sockaddr_in addr;
67 socklen_t addrlen = sizeof(addr);
68 memset(&addr, 0, sizeof(addr));
69 addr.sin_family = AF_INET;
70 addr.sin_addr.s_addr = htonl(INADDR_LOOPBACK);
71 if (sockets->Bind(
72 socket, reinterpret_cast<struct sockaddr *>(&addr), addrlen) < 0 ||
73 sockets->Listen(socket, 1) < 0 ||
74 sockets->GetSockName(
75 socket, reinterpret_cast<struct sockaddr *>(&addr), &addrlen) < 0) {
76 PLOG(ERROR) << "Socket setup failed.";
77 sockets->Close(socket);
78 return false;
79 }
80
Ben Chanfad4a0b2012-04-18 15:49:59 -070081 SLOG(VPN, 2) << "Listening socket: " << socket;
Darin Petkov271fe522012-03-27 13:47:29 +020082 sockets_ = sockets;
Darin Petkov78f63262012-03-26 01:30:24 +020083 socket_ = socket;
84 ready_handler_.reset(
85 dispatcher->CreateReadyHandler(
86 socket, IOHandler::kModeInput, ready_callback_));
87 dispatcher_ = dispatcher;
Darin Petkov46463022012-03-29 14:57:32 +020088
89 // Append openvpn management API options.
90 options->push_back("--management");
91 options->push_back(inet_ntoa(addr.sin_addr));
92 options->push_back(IntToString(ntohs(addr.sin_port)));
93 options->push_back("--management-client");
Darin Petkova5e07ef2012-07-09 14:27:57 +020094
95 options->push_back("--management-hold");
96 hold_release_ = false;
97 hold_waiting_ = false;
98
Darin Petkov46463022012-03-29 14:57:32 +020099 options->push_back("--management-query-passwords");
Darin Petkov46463022012-03-29 14:57:32 +0200100 if (driver_->AppendValueOption(flimflam::kOpenVPNStaticChallengeProperty,
101 "--static-challenge",
102 options)) {
103 options->push_back("1"); // Force echo.
104 }
Darin Petkov78f63262012-03-26 01:30:24 +0200105 return true;
106}
107
108void OpenVPNManagementServer::Stop() {
Ben Chanfad4a0b2012-04-18 15:49:59 -0700109 SLOG(VPN, 2) << __func__;
Darin Petkove08084d2012-06-11 13:19:35 +0200110 if (!IsStarted()) {
Darin Petkov78f63262012-03-26 01:30:24 +0200111 return;
112 }
113 input_handler_.reset();
114 if (connected_socket_ >= 0) {
115 sockets_->Close(connected_socket_);
116 connected_socket_ = -1;
117 }
118 dispatcher_ = NULL;
119 ready_handler_.reset();
120 if (socket_ >= 0) {
121 sockets_->Close(socket_);
122 socket_ = -1;
123 }
124 sockets_ = NULL;
125}
126
Darin Petkova5e07ef2012-07-09 14:27:57 +0200127void OpenVPNManagementServer::ReleaseHold() {
128 SLOG(VPN, 2) << __func__;
129 hold_release_ = true;
130 if (!hold_waiting_) {
131 return;
132 }
133 LOG(INFO) << "Releasing hold.";
134 hold_waiting_ = false;
135 SendHoldRelease();
136}
137
138void OpenVPNManagementServer::Hold() {
139 SLOG(VPN, 2) << __func__;
140 hold_release_ = false;
141}
142
Darin Petkov78f63262012-03-26 01:30:24 +0200143void OpenVPNManagementServer::OnReady(int fd) {
Ben Chanfad4a0b2012-04-18 15:49:59 -0700144 SLOG(VPN, 2) << __func__ << "(" << fd << ")";
Darin Petkov78f63262012-03-26 01:30:24 +0200145 connected_socket_ = sockets_->Accept(fd, NULL, NULL);
146 if (connected_socket_ < 0) {
147 PLOG(ERROR) << "Connected socket accept failed.";
148 return;
149 }
150 ready_handler_.reset();
151 input_handler_.reset(
152 dispatcher_->CreateInputHandler(connected_socket_, input_callback_));
153 SendState("on");
154}
155
156void OpenVPNManagementServer::OnInput(InputData *data) {
Ben Chanfad4a0b2012-04-18 15:49:59 -0700157 SLOG(VPN, 2) << __func__ << "(" << data->len << ")";
Darin Petkov78f63262012-03-26 01:30:24 +0200158 vector<string> messages;
159 SplitString(
160 string(reinterpret_cast<char *>(data->buf), data->len), '\n', &messages);
161 for (vector<string>::const_iterator it = messages.begin();
Darin Petkove08084d2012-06-11 13:19:35 +0200162 it != messages.end() && IsStarted(); ++it) {
Darin Petkov78f63262012-03-26 01:30:24 +0200163 ProcessMessage(*it);
164 }
165}
166
167void OpenVPNManagementServer::ProcessMessage(const string &message) {
Ben Chanfad4a0b2012-04-18 15:49:59 -0700168 SLOG(VPN, 2) << __func__ << "(" << message << ")";
Darin Petkov92e65612012-06-10 12:52:10 +0200169 if (message.empty()) {
170 return;
171 }
172 if (!ProcessInfoMessage(message) &&
173 !ProcessNeedPasswordMessage(message) &&
174 !ProcessFailedPasswordMessage(message) &&
Darin Petkova5e07ef2012-07-09 14:27:57 +0200175 !ProcessStateMessage(message) &&
176 !ProcessHoldMessage(message)) {
Darin Petkov92e65612012-06-10 12:52:10 +0200177 LOG(WARNING) << "OpenVPN management message ignored: " << message;
178 }
Darin Petkov271fe522012-03-27 13:47:29 +0200179}
180
181bool OpenVPNManagementServer::ProcessInfoMessage(const string &message) {
Darin Petkov92e65612012-06-10 12:52:10 +0200182 if (!StartsWithASCII(message, ">INFO:", true)) {
183 return false;
184 }
185 LOG(INFO) << "Processing info message.";
186 return true;
Darin Petkov271fe522012-03-27 13:47:29 +0200187}
188
189bool OpenVPNManagementServer::ProcessNeedPasswordMessage(
190 const string &message) {
191 if (!StartsWithASCII(message, ">PASSWORD:Need ", true)) {
192 return false;
Darin Petkov78f63262012-03-26 01:30:24 +0200193 }
Darin Petkov92e65612012-06-10 12:52:10 +0200194 LOG(INFO) << "Processing need-password message.";
Darin Petkove0d5dd12012-04-04 16:10:48 +0200195 string tag = ParseNeedPasswordTag(message);
196 if (tag == "Auth") {
Darin Petkov683942b2012-03-27 18:00:04 +0200197 if (message.find("SC:") != string::npos) {
Darin Petkove0d5dd12012-04-04 16:10:48 +0200198 PerformStaticChallenge(tag);
Darin Petkov683942b2012-03-27 18:00:04 +0200199 } else {
Darin Petkovdaaa5532012-07-24 15:37:55 +0200200 PerformAuthentication(tag);
Darin Petkov683942b2012-03-27 18:00:04 +0200201 }
Darin Petkove0d5dd12012-04-04 16:10:48 +0200202 } else if (StartsWithASCII(tag, "User-Specific TPM Token", true)) {
203 SupplyTPMToken(tag);
Darin Petkov92e65612012-06-10 12:52:10 +0200204 } else {
205 NOTIMPLEMENTED() << ": Unsupported need-password message: " << message;
206 driver_->Cleanup(Service::kStateFailure);
Darin Petkov683942b2012-03-27 18:00:04 +0200207 }
Darin Petkov271fe522012-03-27 13:47:29 +0200208 return true;
209}
210
Darin Petkove0d5dd12012-04-04 16:10:48 +0200211// static
212string OpenVPNManagementServer::ParseNeedPasswordTag(const string &message) {
Darin Petkov92e65612012-06-10 12:52:10 +0200213 SLOG(VPN, 2) << __func__ << "(" << message << ")";
Darin Petkove0d5dd12012-04-04 16:10:48 +0200214 size_t start = message.find('\'');
215 if (start == string::npos) {
216 return string();
217 }
218 size_t end = message.find('\'', start + 1);
219 if (end == string::npos) {
220 return string();
221 }
222 return message.substr(start + 1, end - start - 1);
223}
224
225void OpenVPNManagementServer::PerformStaticChallenge(const string &tag) {
Darin Petkov92e65612012-06-10 12:52:10 +0200226 LOG(INFO) << "Perform static challenge: " << tag;
Darin Petkov683942b2012-03-27 18:00:04 +0200227 string user =
228 driver_->args()->LookupString(flimflam::kOpenVPNUserProperty, "");
229 string password =
230 driver_->args()->LookupString(flimflam::kOpenVPNPasswordProperty, "");
231 string otp =
232 driver_->args()->LookupString(flimflam::kOpenVPNOTPProperty, "");
233 if (user.empty() || password.empty() || otp.empty()) {
Darin Petkove08084d2012-06-11 13:19:35 +0200234 NOTIMPLEMENTED() << ": Missing credentials:"
235 << (user.empty() ? " no-user" : "")
236 << (password.empty() ? " no-password" : "")
237 << (otp.empty() ? " no-otp" : "");
Darin Petkov0440b9b2012-04-17 16:11:56 +0200238 driver_->Cleanup(Service::kStateFailure);
Darin Petkov683942b2012-03-27 18:00:04 +0200239 return;
240 }
241 gchar *b64_password =
242 glib_->Base64Encode(reinterpret_cast<const guchar *>(password.data()),
243 password.size());
244 gchar *b64_otp =
245 glib_->Base64Encode(reinterpret_cast<const guchar *>(otp.data()),
246 otp.size());
247 if (!b64_password || !b64_otp) {
248 LOG(ERROR) << "Unable to base64-encode credentials.";
249 return;
250 }
Darin Petkove0d5dd12012-04-04 16:10:48 +0200251 SendUsername(tag, user);
252 SendPassword(tag, StringPrintf("SCRV1:%s:%s", b64_password, b64_otp));
Darin Petkov683942b2012-03-27 18:00:04 +0200253 glib_->Free(b64_otp);
254 glib_->Free(b64_password);
255 // Don't reuse OTP.
256 driver_->args()->RemoveString(flimflam::kOpenVPNOTPProperty);
257}
258
Darin Petkovdaaa5532012-07-24 15:37:55 +0200259void OpenVPNManagementServer::PerformAuthentication(const string &tag) {
260 LOG(INFO) << "Perform authentication: " << tag;
261 string user =
262 driver_->args()->LookupString(flimflam::kOpenVPNUserProperty, "");
263 string password =
264 driver_->args()->LookupString(flimflam::kOpenVPNPasswordProperty, "");
265 if (user.empty() || password.empty()) {
266 NOTIMPLEMENTED() << ": Missing credentials:"
267 << (user.empty() ? " no-user" : "")
268 << (password.empty() ? " no-password" : "");
269 driver_->Cleanup(Service::kStateFailure);
270 return;
271 }
272 SendUsername(tag, user);
273 SendPassword(tag, password);
274}
275
Darin Petkove0d5dd12012-04-04 16:10:48 +0200276void OpenVPNManagementServer::SupplyTPMToken(const string &tag) {
Darin Petkov92e65612012-06-10 12:52:10 +0200277 SLOG(VPN, 2) << __func__ << "(" << tag << ")";
Darin Petkove0d5dd12012-04-04 16:10:48 +0200278 string pin = driver_->args()->LookupString(flimflam::kOpenVPNPinProperty, "");
279 if (pin.empty()) {
Darin Petkov0440b9b2012-04-17 16:11:56 +0200280 NOTIMPLEMENTED() << ": Missing PIN.";
281 driver_->Cleanup(Service::kStateFailure);
Darin Petkove0d5dd12012-04-04 16:10:48 +0200282 return;
283 }
284 SendPassword(tag, pin);
285}
286
Darin Petkov271fe522012-03-27 13:47:29 +0200287bool OpenVPNManagementServer::ProcessFailedPasswordMessage(
288 const string &message) {
289 if (!StartsWithASCII(message, ">PASSWORD:Verification Failed:", true)) {
290 return false;
Darin Petkov78f63262012-03-26 01:30:24 +0200291 }
Darin Petkov271fe522012-03-27 13:47:29 +0200292 NOTIMPLEMENTED();
Darin Petkov0440b9b2012-04-17 16:11:56 +0200293 driver_->Cleanup(Service::kStateFailure);
Darin Petkov271fe522012-03-27 13:47:29 +0200294 return true;
295}
296
297// >STATE:* message support. State messages are of the form:
298// >STATE:<date>,<state>,<detail>,<local-ip>,<remote-ip>
299// where:
300// <date> is the current time (since epoch) in seconds
301// <state> is one of:
302// INITIAL, CONNECTING, WAIT, AUTH, GET_CONFIG, ASSIGN_IP, ADD_ROUTES,
303// CONNECTED, RECONNECTING, EXITING, RESOLVE, TCP_CONNECT
304// <detail> is a free-form string giving details about the state change
305// <local-ip> is a dotted-quad for the local IPv4 address (when available)
306// <remote-ip> is a dotted-quad for the remote IPv4 address (when available)
307bool OpenVPNManagementServer::ProcessStateMessage(const string &message) {
308 if (!StartsWithASCII(message, ">STATE:", true)) {
309 return false;
Darin Petkov78f63262012-03-26 01:30:24 +0200310 }
Darin Petkov92e65612012-06-10 12:52:10 +0200311 LOG(INFO) << "Processing state message.";
Darin Petkov271fe522012-03-27 13:47:29 +0200312 vector<string> details;
313 SplitString(message, ',', &details);
314 if (details.size() > 1) {
315 if (details[1] == "RECONNECTING") {
316 driver_->OnReconnecting();
317 }
318 // The rest of the states are currently ignored.
Darin Petkov78f63262012-03-26 01:30:24 +0200319 }
Darin Petkov271fe522012-03-27 13:47:29 +0200320 return true;
Darin Petkov78f63262012-03-26 01:30:24 +0200321}
322
Darin Petkova5e07ef2012-07-09 14:27:57 +0200323bool OpenVPNManagementServer::ProcessHoldMessage(const string &message) {
324 if (!StartsWithASCII(message, ">HOLD:Waiting for hold release", true)) {
325 return false;
326 }
327 LOG(INFO) << "Processing hold message.";
328 hold_waiting_ = true;
329 if (hold_release_) {
330 ReleaseHold();
331 }
332 return true;
333}
334
Darin Petkovdaaa5532012-07-24 15:37:55 +0200335// static
336string OpenVPNManagementServer::EscapeToQuote(const string &str) {
337 string escaped;
338 for (string::const_iterator it = str.begin(); it != str.end(); ++it) {
339 if (*it == '\\' || *it == '"') {
340 escaped += '\\';
341 }
342 escaped += *it;
343 }
344 return escaped;
345}
346
Darin Petkov78f63262012-03-26 01:30:24 +0200347void OpenVPNManagementServer::Send(const string &data) {
Ben Chanfad4a0b2012-04-18 15:49:59 -0700348 SLOG(VPN, 2) << __func__;
Darin Petkov78f63262012-03-26 01:30:24 +0200349 ssize_t len = sockets_->Send(connected_socket_, data.data(), data.size(), 0);
350 PLOG_IF(ERROR, len < 0 || static_cast<size_t>(len) != data.size())
Darin Petkov683942b2012-03-27 18:00:04 +0200351 << "Send failed.";
Darin Petkov78f63262012-03-26 01:30:24 +0200352}
353
354void OpenVPNManagementServer::SendState(const string &state) {
Ben Chanfad4a0b2012-04-18 15:49:59 -0700355 SLOG(VPN, 2) << __func__ << "(" << state << ")";
Darin Petkov78f63262012-03-26 01:30:24 +0200356 Send(StringPrintf("state %s\n", state.c_str()));
Darin Petkov1c115202012-03-22 15:35:47 +0100357}
358
Darin Petkov683942b2012-03-27 18:00:04 +0200359void OpenVPNManagementServer::SendUsername(const string &tag,
360 const string &username) {
Ben Chanfad4a0b2012-04-18 15:49:59 -0700361 SLOG(VPN, 2) << __func__;
Darin Petkov683942b2012-03-27 18:00:04 +0200362 Send(StringPrintf("username \"%s\" %s\n", tag.c_str(), username.c_str()));
363}
364
365void OpenVPNManagementServer::SendPassword(const string &tag,
366 const string &password) {
Ben Chanfad4a0b2012-04-18 15:49:59 -0700367 SLOG(VPN, 2) << __func__;
Darin Petkovdaaa5532012-07-24 15:37:55 +0200368 Send(StringPrintf("password \"%s\" \"%s\"\n",
369 tag.c_str(),
370 EscapeToQuote(password).c_str()));
Darin Petkov683942b2012-03-27 18:00:04 +0200371}
372
Darin Petkova5e07ef2012-07-09 14:27:57 +0200373void OpenVPNManagementServer::SendHoldRelease() {
374 SLOG(VPN, 2) << __func__;
375 Send("hold release\n");
376}
377
Darin Petkov1c115202012-03-22 15:35:47 +0100378} // namespace shill